I have the same question.
Looking through the SBSFU code, the UART calls are abstracted down to SFU_LL_UART_[Init, Deinit, Transmit, Receive, Flush]. These just call the standard HAL_UART functions. Substituting calls to appropriately abstracted CDC calls might work.
I have no idea what exposing the USB stack would have on the security of the bootloader. Perhaps someone from ST could comment?
